What Is an SSH Key? How It Works & How to Generate One

Ever found yourself typing the same password over and over while managing servers? I’ve done that, and it’s frustrating. There’s a smarter way: SSH keys. They replace passwords with a secure, automated handshake. In this article, I’ll explain what SSH keys are, how they work, and how you can set them up—even if you’re new to servers.

What Is an SSH Key

An SSH key is a pair of cryptographic keys that authenticate your identity to a remote server. Instead of typing a password, your computer presents a digital signature. The server verifies it using public-key cryptography. This means only you can log in. Think of it like a lock and key. The public key is the lock; you install it on the server. The private key is the physical key; you keep it on your local machine, never shared. When you connect, the server challenges you to prove you have the private key—without ever seeing it. Mathematically, this proof is sound. This method stops brute-force attacks and accidental leaks. Once set up, you’ll forget what a password prompt looks like.

What Is an SSH Key Pair

Every SSH key consists of two parts: a private key and a public key. The private key stays on your computer, guarded with a passphrase if you choose. The public key goes onto every server you want to access. They are mathematically linked. You can share the public key openly, but the private key must remain secret. If someone gets your private key, they can impersonate you. That’s why I treat my private key like my house key—never lost. The magic happens during authentication. Your client uses the private key to generate a signature. The server checks that signature with the stored public key. If it matches, you’re in. No password transmitted. Simple and secure.

Why Use SSH Keys

Passwords have many problems. They’re easy to guess, steal, or forget. SSH keys solve these issues. With keys, you get stronger security without the hassle. Keys are essentially unguessable because they’re thousands of bits long. They also enable automation. As a system administrator, I often run scripts that transfer files or execute commands across servers. Without SSH keys, each script would need a hardcoded password or manual entry—both dangerous. Keys let these tasks run silently and safely. For cross-border e-commerce sellers, server security is critical. I’ve watched several online store owners struggle with weak passwords and daily brute‑force attempts. After switching to SSH keys, the attacks stopped. A key is simply too long to crack. You can focus on growing your business instead of monitoring failed logins. You should still use a passphrase on your private key for an extra layer. That way, even if someone steals the key file, they can’t use it without the passphrase.

What Are SSH Key Algorithms

Not all keys are created equal. The algorithm used determines security and speed. The most common today are RSA, Ed25519, and ECDSA. RSA is the grandfather. It works everywhere but requires large key sizes—at least 3072 bits—to be considered secure today. Ed25519 is the modern favorite. It’s faster, uses much smaller keys (256 bits), and offers better security per bit. An Ed25519 key is compact—its private key is only 64 bytes—and extremely fast to verify. That means quicker logins. RSA, on the other hand, needs at least 3072 bits to be safe, which adds overhead. I’d avoid DSA; it’s outdated and has known vulnerabilities. I recommend Ed25519 for any new key pair. If you’re using an old system that doesn’t support Ed25519, fall back to RSA with 4096 bits. Always check your server’s documentation to know which algorithms it accepts.

How to Generate SSH Keys Using ssh-keygen?

The ssh-keygen tool comes with OpenSSH, which is installed on almost every Linux, macOS, and modern Windows system. It’s the standard way to create keys from the command line. I’ll walk you through it. First, open your terminal. On Linux or macOS, use the built-in Terminal app. On Windows, you can open Git Bash (which brings the command to Windows), or use PowerShell with OpenSSH client enabled. Type the following command and press Enter:
ssh-keygen -t ed25519 -C "your_email@example.com"
The -t ed25519 tells it to generate an Ed25519 key. Replace the email with your own; it’s just a label. The tool will ask where to save the key. The default location is ~/.ssh/id_ed25519. Press Enter to accept it. Next, it will prompt for a passphrase. I strongly recommend you set one. You can leave it blank by pressing Enter, but that’s less secure. Type a strong passphrase and confirm it. After that, the key pair is created. You’ll see a message like “Your identification has been saved.” Two files appear: the private key id_ed25519 and the public key id_ed25519.pub. Never share the private one. The public one is safe to upload. If you already have a key with the same name, ssh-keygen will ask to overwrite. Choose a different filename by typing a custom path. I sometimes use id_ed25519_git to keep things organized.

ssh-keygen tool is not the only way to generate SSH keys, you can also generate ssh keys with openSSH or PuTTYgen.

How to Copy SSH Key with ssh-copy-id?

Now you have a key pair. The next step is to deploy the public key to your server. The simplest method is the ssh-copy-id script, which comes with OpenSSH. Open your terminal and run:
ssh-copy-id user@your-server-ip
Replace user with your username and your-server-ip with the server’s IP. You’ll be prompted for the user’s password one last time. The script copies your public key (by default ~/.ssh/id_ed25519.pub) to the server’s ~/.ssh/authorized_keys file. That’s it. Try logging in with ssh user@your-server-ip. You should not need a password—if you set a passphrase, you’ll be asked for that instead.
What if ssh-copy-id isn’t available? You can do it manually. Run:
cat ~/.ssh/id_ed25519.pub | ssh user@your-server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
This pipes the public key content directly into the server’s authorized_keys file, creating the .ssh directory if missing. After that, ensure permissions are correct by logging in and running chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys. That’s it! Now you can connect without a password.

Securing Your Private Key

Always protect it with a strong passphrase when you create it—this encrypts the file so that even if someone copies it, they still can’t use it. Store the key inside your ~/.ssh/ folder; its default permissions of 700 keep it readable only by your user account.

Never share your private key with anyone, and avoid sending it over the network. If you must transfer it, use a USB drive instead of email or chat. On the server side, confirm that ~/.ssh/authorized_keys has strict permissions — chmod 600 prevents other users from tampering with it. To avoid typing your passphrase every time, use an SSH agent. Good practice is to rotate your keys every six to twelve months, or immediately if you suspect a breach. A little discipline here prevents huge headaches later.

What Is an SSH Key FAQs

Q1: Can I use one SSH key for all my servers?
Absolutely. Just copy your public key to each server’s authorized_keys file. It’s like having one master key.

Q2: How do I change the passphrase on an existing key?
Use ssh-keygen -p -f ~/.ssh/id_ed25519. You’ll be asked for the old passphrase and then can set a new one.

Q3: Is it safe to generate SSH keys on a cloud console?
For maximum security, generate the key on your local machine. While cloud‑generated keys are often fine, you must trust the provider’s processes, and your private key could be exposed if their interface is ever compromised.

Conclusion

SSH keys are a simple yet powerful way to secure your server access. You’ve learned what they are, how to create them with ssh-keygen or PuTTYgen, and how to install them on a server. Swap out those passwords and embrace key-based authentication. Your servers will thank you.